{
  "finding_id": "DF-3923",
  "title": "hpt_attach bus_setup_intr failure kfree()s the newbus-owned IAL_ADAPTER_T softc while it stays linked on gIal_Adapter (UAF)",
  "verdict": "not_reproduced (hardware-gated attach-error path)",
  "impact_potential": "kernel use-after-free via gIal_Adapter walks / newbus softc reuse",
  "reproduce": {
    "build": "n/a",
    "run": "RR1820 passthrough VM with IRQ allocation/setup failure at attach, then hptmv ioctl / rescan",
    "expected": "freed-softc dereference; NOT runnable on audit guest"
  },
  "kernel_refs": ["sys/dev/raid/hptmv/entry.c:2026", "sys/dev/raid/hptmv/entry.c:1992", "sys/dev/raid/hptmv/entry.c:1280", "sys/dev/raid/hptmv/ioctl.c:302"],
  "artifacts": ["README.md", "VERDICT.md", "fix.diff", "env.txt", "manifest.json", "verdict.json"]
}